Detection Engineering
78 items from infosecb/awesome-detection-engineering ★1,357
-
osquery osquery.io
osquery is an instrumentation framework that expose the operating system as a high-performance relational database.
-
Detection Engineering Twitter List | Zack Allen x.com
A Twitter list of Detection Engineering thought leaders.
-
Cloud Threat Landscape | Wiz threats.wiz.io
A cloud detection engineering-focused database, that lists threat actors known to have compromised cloud environments, the tools and techniques in their arsenal, and the technologies they prefer to target.
-
SOCLabs soc-labs.top
A lab for blue teamers and detection engineers, with real threat data and support for popular SIEM query languages, enabling hands-on learning and practice in detection rule writing and threat hunting.
-
Sigma rule converter sigconverter.io
An opensource tool that can convert detection content for use with most SIEMs.
-
Open Cybersecurity Schema Framework (OCSF) schema.ocsf.io
An opensource security data source and event schema.
-
Blue-team-as-Code - the Spiral of Joy | Den Iuzvyk, Oleg Kolesnikov sansorg.egnyte.com
Blue-Team-as-Code: Lessons From Real-world Red Team Detection Automation Using Logs.
-
Detection Maturity Level (DML) Model | Ryan Stillions ryanstillions.blogspot.com
Defines and describes 8 different levels of an organization's threat detection program maturity.
-
-
Detection at Scale Podcast | Jack Naglieri podcasts.apple.com
A detection engineering-focused podcast featuring many thought leaders in the specialization.
-
ATT&CK Navigator | MITRE mitre-attack.github.io
MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework.
-
Prioritizing Detection Engineering | Ryan McGeehan medium.com
A longtime detection engineer outlines how a detection engineering program should be built from the ground up.
-
Threat Detection Maturity Framework | Haider Dost of Snowflake medium.com
A maturity matrix to measure the success of your threat detection program.
-
Detection Development Lifecycle | Haider Dost et al. medium.com
Snowflake’s implementation of the Detection Development Lifecycle.
-
MITRE ATT&CK Data Sources Blog Post medium.com
MITRE describes various data sources and how they relate to the TTPs found in the MITRE ATT&CK framework.
-
DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ mbsecure.nl
Outlines a methodology measuring security data visibility and detection coverage against the MITRE ATT&CK framework.
-
Windows Logging Cheatsheets malwarearchaeology.com
Multiple cheatsheets outlined recommendations for Windows Event logging at various levels of granularity.
-
-
Cyber Kill Chain | Lockheed Martin lockheedmartin.com
Lockheed Martin's framework that outlines the 7 stages commonly observed in a cyber attack.
-
Microsoft XDR Advanced Hunting Schema learn.microsoft.com
To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types.
-
Azure Defender for Cloud Security Alerts learn.microsoft.com
A list of all Azure Security for Cloud Alerts, their descriptions, and associated data sources.
-
InnerWarden innerwarden.com
Autonomous security agent for Linux with real-time threat detection and response via 38 eBPF hooks, 48 detectors, and 23 correlation rules.
-
Detection Engineering AI Maturity Framework | Brendan Chamberlain infosecb.github.io
A community framework with four maturity levels across ten dimensions for assessing how organizations apply AI and LLMs across a detection engineering program, from foundations through the detection lifecycle.
-
-
Open Threat Informed Detection Engineering aka OpenTide' github.com
an all-in-one Detection Engineering Operations framework created and maintained by the European Commission to convert your CTI into an actionable detection coverage graph combining threat vectors with detection objectives, and manage your entire detection library from a central…
-
Linux auditd Detection Ruleset github.com
Linux auditd ruleset that produces telemetry required for threat detection use cases.
-
Splunk ES Correlation Searches Best Practices | OpsTune github.com
A highly detailed guide to producing high quality detection content in the Splunk Enterprise Security app.
-
Elastic Yara Signatures github.com
Elastic's YARA signatures, which run on the Elastic endpoint agent.
-
Elastic Endpoint Behavioral Rules github.com
Elastic's endpoint behavioral (prevention) rules written in EQL, natively for the Elastic endpoint agent.
-
Elastic Endpoint Ransomware Artifact github.com
Elastic's ransomware artifact, which runs on the Elastic endpoint agent.
- next page of items loading…
